From: Greg Kroah-Hartman Date: Mon, 25 May 2020 14:27:33 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.225~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=57726f3fdbbe13819e4b5ba9bb15834479c02ac0;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: device-dax-don-t-leak-kernel-memory-to-user-space-after-unloading-kmem.patch iio-adc-ti-ads8344-fix-channel-selection.patch iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch iio-sca3000-remove-an-erroneous-get_device.patch ipack-tpci200-fix-error-return-code-in-tpci200_register.patch kasan-disable-branch-tracing-for-core-runtime.patch mei-release-me_cl-object-reference.patch misc-rtsx-add-short-delay-after-exit-from-aspm.patch rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch s390-kaslr-add-support-for-r_390_jmp_slot-relocation-type.patch s390-pci-fix-s390_mmio_read-write-with-mio.patch sh-include-linux-time_types.h-for-sockios.patch staging-greybus-fix-uninitialized-scalar-variable.patch staging-iio-ad2s1210-fix-spi-reading.patch staging-kpc2000-fix-error-return-code-in-kp2000_pcie_probe.patch tty-serial-add-missing-spin_lock_init-for-sifive-serial-console.patch --- diff --git a/queue-5.4/device-dax-don-t-leak-kernel-memory-to-user-space-after-unloading-kmem.patch b/queue-5.4/device-dax-don-t-leak-kernel-memory-to-user-space-after-unloading-kmem.patch new file mode 100644 index 00000000000..f1bfa64dadb --- /dev/null +++ b/queue-5.4/device-dax-don-t-leak-kernel-memory-to-user-space-after-unloading-kmem.patch @@ -0,0 +1,129 @@ +From 60858c00e5f018eda711a3aa84cf62214ef62d61 Mon Sep 17 00:00:00 2001 +From: David Hildenbrand +Date: Fri, 22 May 2020 22:22:42 -0700 +Subject: device-dax: don't leak kernel memory to user space after unloading kmem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Hildenbrand + +commit 60858c00e5f018eda711a3aa84cf62214ef62d61 upstream. + +Assume we have kmem configured and loaded: + + [root@localhost ~]# cat /proc/iomem + ... + 140000000-33fffffff : Persistent Memory$ + 140000000-1481fffff : namespace0.0 + 150000000-33fffffff : dax0.0 + 150000000-33fffffff : System RAM + +Assume we try to unload kmem. This force-unloading will work, even if +memory cannot get removed from the system. + + [root@localhost ~]# rmmod kmem + [ 86.380228] removing memory fails, because memory [0x0000000150000000-0x0000000157ffffff] is onlined + ... + [ 86.431225] kmem dax0.0: DAX region [mem 0x150000000-0x33fffffff] cannot be hotremoved until the next reboot + +Now, we can reconfigure the namespace: + + [root@localhost ~]# ndctl create-namespace --force --reconfig=namespace0.0 --mode=devdax + [ 131.409351] nd_pmem namespace0.0: could not reserve region [mem 0x140000000-0x33fffffff]dax + [ 131.410147] nd_pmem: probe of namespace0.0 failed with error -16namespace0.0 --mode=devdax + ... + +This fails as expected due to the busy memory resource, and the memory +cannot be used. However, the dax0.0 device is removed, and along its +name. + +The name of the memory resource now points at freed memory (name of the +device): + + [root@localhost ~]# cat /proc/iomem + ... + 140000000-33fffffff : Persistent Memory + 140000000-1481fffff : namespace0.0 + 150000000-33fffffff : �_�^7_��/_��wR��WQ���^��� ... + 150000000-33fffffff : System RAM + +We have to make sure to duplicate the string. While at it, remove the +superfluous setting of the name and fixup a stale comment. + +Fixes: 9f960da72b25 ("device-dax: "Hotremove" persistent memory that is used like normal RAM") +Signed-off-by: David Hildenbrand +Signed-off-by: Andrew Morton +Cc: Dan Williams +Cc: Vishal Verma +Cc: Dave Jiang +Cc: Pavel Tatashin +Cc: Andrew Morton +Cc: [5.3] +Link: http://lkml.kernel.org/r/20200508084217.9160-2-david@redhat.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dax/kmem.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/dax/kmem.c ++++ b/drivers/dax/kmem.c +@@ -22,6 +22,7 @@ int dev_dax_kmem_probe(struct device *de + resource_size_t kmem_size; + resource_size_t kmem_end; + struct resource *new_res; ++ const char *new_res_name; + int numa_node; + int rc; + +@@ -48,11 +49,16 @@ int dev_dax_kmem_probe(struct device *de + kmem_size &= ~(memory_block_size_bytes() - 1); + kmem_end = kmem_start + kmem_size; + +- /* Region is permanently reserved. Hot-remove not yet implemented. */ +- new_res = request_mem_region(kmem_start, kmem_size, dev_name(dev)); ++ new_res_name = kstrdup(dev_name(dev), GFP_KERNEL); ++ if (!new_res_name) ++ return -ENOMEM; ++ ++ /* Region is permanently reserved if hotremove fails. */ ++ new_res = request_mem_region(kmem_start, kmem_size, new_res_name); + if (!new_res) { + dev_warn(dev, "could not reserve region [%pa-%pa]\n", + &kmem_start, &kmem_end); ++ kfree(new_res_name); + return -EBUSY; + } + +@@ -63,12 +69,12 @@ int dev_dax_kmem_probe(struct device *de + * unknown to us that will break add_memory() below. + */ + new_res->flags = IORESOURCE_SYSTEM_RAM; +- new_res->name = dev_name(dev); + + rc = add_memory(numa_node, new_res->start, resource_size(new_res)); + if (rc) { + release_resource(new_res); + kfree(new_res); ++ kfree(new_res_name); + return rc; + } + dev_dax->dax_kmem_res = new_res; +@@ -83,6 +89,7 @@ static int dev_dax_kmem_remove(struct de + struct resource *res = dev_dax->dax_kmem_res; + resource_size_t kmem_start = res->start; + resource_size_t kmem_size = resource_size(res); ++ const char *res_name = res->name; + int rc; + + /* +@@ -102,6 +109,7 @@ static int dev_dax_kmem_remove(struct de + /* Release and free dax resources */ + release_resource(res); + kfree(res); ++ kfree(res_name); + dev_dax->dax_kmem_res = NULL; + + return 0; diff --git a/queue-5.4/iio-adc-ti-ads8344-fix-channel-selection.patch b/queue-5.4/iio-adc-ti-ads8344-fix-channel-selection.patch new file mode 100644 index 00000000000..054e8920315 --- /dev/null +++ b/queue-5.4/iio-adc-ti-ads8344-fix-channel-selection.patch @@ -0,0 +1,69 @@ +From bcfa1e253d2e329e1ebab5c89f3c73f6dd17606c Mon Sep 17 00:00:00 2001 +From: Gregory CLEMENT +Date: Thu, 30 Apr 2020 15:05:47 +0200 +Subject: iio: adc: ti-ads8344: Fix channel selection + +From: Gregory CLEMENT + +commit bcfa1e253d2e329e1ebab5c89f3c73f6dd17606c upstream. + +During initial submission the selection of the channel was done using +the scan_index member of the iio_chan_spec structure. It was an abuse +because this member is supposed to be used with a buffer so it was +removed. + +However there was still the need to be able to known how to select a +channel, the correct member to store this information is address. + +Thanks to this it is possible to select any other channel than the +channel 0. + +Fixes: 8dd2d7c0fed7 ("iio: adc: Add driver for the TI ADS8344 A/DC chips") +Signed-off-by: Gregory CLEMENT +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ti-ads8344.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/ti-ads8344.c ++++ b/drivers/iio/adc/ti-ads8344.c +@@ -32,16 +32,17 @@ struct ads8344 { + u8 rx_buf[3]; + }; + +-#define ADS8344_VOLTAGE_CHANNEL(chan, si) \ ++#define ADS8344_VOLTAGE_CHANNEL(chan, addr) \ + { \ + .type = IIO_VOLTAGE, \ + .indexed = 1, \ + .channel = chan, \ + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ + .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), \ ++ .address = addr, \ + } + +-#define ADS8344_VOLTAGE_CHANNEL_DIFF(chan1, chan2, si) \ ++#define ADS8344_VOLTAGE_CHANNEL_DIFF(chan1, chan2, addr) \ + { \ + .type = IIO_VOLTAGE, \ + .indexed = 1, \ +@@ -50,6 +51,7 @@ struct ads8344 { + .differential = 1, \ + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ + .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), \ ++ .address = addr, \ + } + + static const struct iio_chan_spec ads8344_channels[] = { +@@ -105,7 +107,7 @@ static int ads8344_read_raw(struct iio_d + switch (mask) { + case IIO_CHAN_INFO_RAW: + mutex_lock(&adc->lock); +- *value = ads8344_adc_conversion(adc, channel->scan_index, ++ *value = ads8344_adc_conversion(adc, channel->address, + channel->differential); + mutex_unlock(&adc->lock); + if (*value < 0) diff --git a/queue-5.4/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch b/queue-5.4/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch new file mode 100644 index 00000000000..3e7e2ede00f --- /dev/null +++ b/queue-5.4/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch @@ -0,0 +1,31 @@ +From aad4742fbf0a560c25827adb58695a4497ffc204 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 26 Apr 2020 21:44:03 +0200 +Subject: iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()' + +From: Christophe JAILLET + +commit aad4742fbf0a560c25827adb58695a4497ffc204 upstream. + +A call to 'vf610_dac_exit()' is missing in an error handling path. + +Fixes: 1b983bf42fad ("iio: dac: vf610_dac: Add IIO DAC driver for Vybrid SoC") +Signed-off-by: Christophe JAILLET +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/dac/vf610_dac.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dac/vf610_dac.c ++++ b/drivers/iio/dac/vf610_dac.c +@@ -225,6 +225,7 @@ static int vf610_dac_probe(struct platfo + return 0; + + error_iio_device_register: ++ vf610_dac_exit(info); + clk_disable_unprepare(info->clk); + + return ret; diff --git a/queue-5.4/iio-sca3000-remove-an-erroneous-get_device.patch b/queue-5.4/iio-sca3000-remove-an-erroneous-get_device.patch new file mode 100644 index 00000000000..600d01f1c70 --- /dev/null +++ b/queue-5.4/iio-sca3000-remove-an-erroneous-get_device.patch @@ -0,0 +1,36 @@ +From 928edefbc18cd8433f7df235c6e09a9306e7d580 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Wed, 6 May 2020 05:52:06 +0200 +Subject: iio: sca3000: Remove an erroneous 'get_device()' + +From: Christophe JAILLET + +commit 928edefbc18cd8433f7df235c6e09a9306e7d580 upstream. + +This looks really unusual to have a 'get_device()' hidden in a 'dev_err()' +call. +Remove it. + +While at it add a missing \n at the end of the message. + +Fixes: 574fb258d636 ("Staging: IIO: VTI sca3000 series accelerometer driver (spi)") +Signed-off-by: Christophe JAILLET +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/sca3000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/sca3000.c ++++ b/drivers/iio/accel/sca3000.c +@@ -980,7 +980,7 @@ static int sca3000_read_data(struct sca3 + st->tx[0] = SCA3000_READ_REG(reg_address_high); + ret = spi_sync_transfer(st->us, xfer, ARRAY_SIZE(xfer)); + if (ret) { +- dev_err(get_device(&st->us->dev), "problem reading register"); ++ dev_err(&st->us->dev, "problem reading register\n"); + return ret; + } + diff --git a/queue-5.4/ipack-tpci200-fix-error-return-code-in-tpci200_register.patch b/queue-5.4/ipack-tpci200-fix-error-return-code-in-tpci200_register.patch new file mode 100644 index 00000000000..683863f1dac --- /dev/null +++ b/queue-5.4/ipack-tpci200-fix-error-return-code-in-tpci200_register.patch @@ -0,0 +1,34 @@ +From 133317479f0324f6faaf797c4f5f3e9b1b36ce35 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Thu, 7 May 2020 09:42:37 +0000 +Subject: ipack: tpci200: fix error return code in tpci200_register() + +From: Wei Yongjun + +commit 133317479f0324f6faaf797c4f5f3e9b1b36ce35 upstream. + +Fix to return negative error code -ENOMEM from the ioremap() error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 43986798fd50 ("ipack: add error handling for ioremap_nocache") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Cc: stable +Acked-by: Samuel Iglesias Gonsalvez +Link: https://lore.kernel.org/r/20200507094237.13599-1-weiyongjun1@huawei.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ipack/carriers/tpci200.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ipack/carriers/tpci200.c ++++ b/drivers/ipack/carriers/tpci200.c +@@ -306,6 +306,7 @@ static int tpci200_register(struct tpci2 + "(bn 0x%X, sn 0x%X) failed to map driver user space!", + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); ++ res = -ENOMEM; + goto out_release_mem8_space; + } + diff --git a/queue-5.4/kasan-disable-branch-tracing-for-core-runtime.patch b/queue-5.4/kasan-disable-branch-tracing-for-core-runtime.patch new file mode 100644 index 00000000000..bcc30ba2da3 --- /dev/null +++ b/queue-5.4/kasan-disable-branch-tracing-for-core-runtime.patch @@ -0,0 +1,80 @@ +From 33cd65e73abd693c00c4156cf23677c453b41b3b Mon Sep 17 00:00:00 2001 +From: Marco Elver +Date: Fri, 22 May 2020 22:22:59 -0700 +Subject: kasan: disable branch tracing for core runtime + +From: Marco Elver + +commit 33cd65e73abd693c00c4156cf23677c453b41b3b upstream. + +During early boot, while KASAN is not yet initialized, it is possible to +enter reporting code-path and end up in kasan_report(). + +While uninitialized, the branch there prevents generating any reports, +however, under certain circumstances when branches are being traced +(TRACE_BRANCH_PROFILING), we may recurse deep enough to cause kernel +reboots without warning. + +To prevent similar issues in future, we should disable branch tracing +for the core runtime. + +[elver@google.com: remove duplicate DISABLE_BRANCH_PROFILING, per Qian Cai] + Link: https://lore.kernel.org/lkml/20200517011732.GE24705@shao2-debian/ + Link: http://lkml.kernel.org/r/20200522075207.157349-1-elver@google.com +Reported-by: kernel test robot +Signed-off-by: Marco Elver +Signed-off-by: Andrew Morton +Reviewed-by: Andrey Konovalov +Cc: Dmitry Vyukov +Cc: Alexander Potapenko +Cc: Andrey Ryabinin +Cc: Qian Cai +Cc: +Link: http://lkml.kernel.org/r//20200517011732.GE24705@shao2-debian/ +Link: http://lkml.kernel.org/r/20200519182459.87166-1-elver@google.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/kasan/Makefile | 8 ++++---- + mm/kasan/generic.c | 1 - + mm/kasan/tags.c | 1 - + 3 files changed, 4 insertions(+), 6 deletions(-) + +--- a/mm/kasan/Makefile ++++ b/mm/kasan/Makefile +@@ -14,10 +14,10 @@ CFLAGS_REMOVE_tags.o = $(CC_FLAGS_FTRACE + # Function splitter causes unnecessary splits in __asan_load1/__asan_store1 + # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533 + +-CFLAGS_common.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) +-CFLAGS_generic.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) +-CFLAGS_generic_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) +-CFLAGS_tags.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) ++CFLAGS_common.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING ++CFLAGS_generic.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING ++CFLAGS_generic_report.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING ++CFLAGS_tags.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector) -DDISABLE_BRANCH_PROFILING + + obj-$(CONFIG_KASAN) := common.o init.o report.o + obj-$(CONFIG_KASAN_GENERIC) += generic.o generic_report.o quarantine.o +--- a/mm/kasan/generic.c ++++ b/mm/kasan/generic.c +@@ -15,7 +15,6 @@ + */ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +-#define DISABLE_BRANCH_PROFILING + + #include + #include +--- a/mm/kasan/tags.c ++++ b/mm/kasan/tags.c +@@ -12,7 +12,6 @@ + */ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +-#define DISABLE_BRANCH_PROFILING + + #include + #include diff --git a/queue-5.4/mei-release-me_cl-object-reference.patch b/queue-5.4/mei-release-me_cl-object-reference.patch new file mode 100644 index 00000000000..9228008eefd --- /dev/null +++ b/queue-5.4/mei-release-me_cl-object-reference.patch @@ -0,0 +1,45 @@ +From fc9c03ce30f79b71807961bfcb42be191af79873 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Wed, 13 May 2020 01:31:40 +0300 +Subject: mei: release me_cl object reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Usyskin + +commit fc9c03ce30f79b71807961bfcb42be191af79873 upstream. + +Allow me_cl object to be freed by releasing the reference +that was acquired by one of the search functions: +__mei_me_cl_by_uuid_id() or __mei_me_cl_by_uuid() + +Cc: +Reported-by: 亿一 +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20200512223140.32186-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/client.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -266,6 +266,7 @@ void mei_me_cl_rm_by_uuid(struct mei_dev + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid(dev, uuid); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + +@@ -287,6 +288,7 @@ void mei_me_cl_rm_by_uuid_id(struct mei_ + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + diff --git a/queue-5.4/misc-rtsx-add-short-delay-after-exit-from-aspm.patch b/queue-5.4/misc-rtsx-add-short-delay-after-exit-from-aspm.patch new file mode 100644 index 00000000000..97c1616e94c --- /dev/null +++ b/queue-5.4/misc-rtsx-add-short-delay-after-exit-from-aspm.patch @@ -0,0 +1,42 @@ +From 7a839dbab1be59f5ed3b3b046de29e166784c9b4 Mon Sep 17 00:00:00 2001 +From: Klaus Doth +Date: Fri, 22 May 2020 12:56:04 +0200 +Subject: misc: rtsx: Add short delay after exit from ASPM + +From: Klaus Doth + +commit 7a839dbab1be59f5ed3b3b046de29e166784c9b4 upstream. + +DMA transfers to and from the SD card stall for 10 seconds and run into +timeout on RTS5260 card readers after ASPM was enabled. + +Adding a short msleep after disabling ASPM fixes the issue on several +Dell Precision 7530/7540 systems I tested. + +This function is only called when waking up after the chip went into +power-save after not transferring data for a few seconds. The added +msleep does therefore not change anything in data transfer speed or +induce any excessive waiting while data transfers are running, or the +chip is sleeping. Only the transition from sleep to active is affected. + +Signed-off-by: Klaus Doth +Cc: stable +Link: https://lore.kernel.org/r/4434eaa7-2ee3-a560-faee-6cee63ebd6d4@doth.eu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/cardreader/rtsx_pcr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/misc/cardreader/rtsx_pcr.c ++++ b/drivers/misc/cardreader/rtsx_pcr.c +@@ -143,6 +143,9 @@ static void rtsx_comm_pm_full_on(struct + + rtsx_disable_aspm(pcr); + ++ /* Fixes DMA transfer timout issue after disabling ASPM on RTS5260 */ ++ msleep(1); ++ + if (option->ltr_enabled) + rtsx_set_ltr_latency(pcr, option->ltr_active_latency); + diff --git a/queue-5.4/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch b/queue-5.4/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch new file mode 100644 index 00000000000..0b1f437a049 --- /dev/null +++ b/queue-5.4/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch @@ -0,0 +1,48 @@ +From ffca476a0a8d26de767cc41d62b8ca7f540ecfdd Mon Sep 17 00:00:00 2001 +From: John Hubbard +Date: Fri, 22 May 2020 22:22:48 -0700 +Subject: rapidio: fix an error in get_user_pages_fast() error handling + +From: John Hubbard + +commit ffca476a0a8d26de767cc41d62b8ca7f540ecfdd upstream. + +In the case of get_user_pages_fast() returning fewer pages than +requested, rio_dma_transfer() does not quite do the right thing. It +attempts to release all the pages that were requested, rather than just +the pages that were pinned. + +Fix the error handling so that only the pages that were successfully +pinned are released. + +Fixes: e8de370188d0 ("rapidio: add mport char device driver") +Signed-off-by: John Hubbard +Signed-off-by: Andrew Morton +Reviewed-by: Andrew Morton +Cc: Matt Porter +Cc: Alexandre Bounine +Cc: Sumit Semwal +Cc: Dan Carpenter +Cc: +Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -877,6 +877,11 @@ rio_dma_transfer(struct file *filp, u32 + rmcd_error("pinned %ld out of %ld pages", + pinned, nr_pages); + ret = -EFAULT; ++ /* ++ * Set nr_pages up to mean "how many pages to unpin, in ++ * the error handler: ++ */ ++ nr_pages = pinned; + goto err_pg; + } + diff --git a/queue-5.4/s390-kaslr-add-support-for-r_390_jmp_slot-relocation-type.patch b/queue-5.4/s390-kaslr-add-support-for-r_390_jmp_slot-relocation-type.patch new file mode 100644 index 00000000000..cc1c96be8fe --- /dev/null +++ b/queue-5.4/s390-kaslr-add-support-for-r_390_jmp_slot-relocation-type.patch @@ -0,0 +1,41 @@ +From 4c1cbcbd6c56c79de2c07159be4f55386bb0bef2 Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Wed, 6 May 2020 13:45:52 +0200 +Subject: s390/kaslr: add support for R_390_JMP_SLOT relocation type + +From: Gerald Schaefer + +commit 4c1cbcbd6c56c79de2c07159be4f55386bb0bef2 upstream. + +With certain kernel configurations, the R_390_JMP_SLOT relocation type +might be generated, which is not expected by the KASLR relocation code, +and the kernel stops with the message "Unknown relocation type". + +This was found with a zfcpdump kernel config, where CONFIG_MODULES=n +and CONFIG_VFIO=n. In that case, symbol_get() is used on undefined +__weak symbols in virt/kvm/vfio.c, which results in the generation +of R_390_JMP_SLOT relocation types. + +Fix this by handling R_390_JMP_SLOT similar to R_390_GLOB_DAT. + +Fixes: 805bc0bc238f ("s390/kernel: build a relocatable kernel") +Cc: # v5.2+ +Signed-off-by: Gerald Schaefer +Reviewed-by: Philipp Rudo +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/machine_kexec_reloc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/kernel/machine_kexec_reloc.c ++++ b/arch/s390/kernel/machine_kexec_reloc.c +@@ -28,6 +28,7 @@ int arch_kexec_do_relocs(int r_type, voi + break; + case R_390_64: /* Direct 64 bit. */ + case R_390_GLOB_DAT: ++ case R_390_JMP_SLOT: + *(u64 *)loc = val; + break; + case R_390_PC16: /* PC relative 16 bit. */ diff --git a/queue-5.4/s390-pci-fix-s390_mmio_read-write-with-mio.patch b/queue-5.4/s390-pci-fix-s390_mmio_read-write-with-mio.patch new file mode 100644 index 00000000000..ecdd1abf37d --- /dev/null +++ b/queue-5.4/s390-pci-fix-s390_mmio_read-write-with-mio.patch @@ -0,0 +1,335 @@ +From f058599e22d59e594e5aae1dc10560568d8f4a8b Mon Sep 17 00:00:00 2001 +From: Niklas Schnelle +Date: Thu, 26 Mar 2020 12:22:50 +0100 +Subject: s390/pci: Fix s390_mmio_read/write with MIO + +From: Niklas Schnelle + +commit f058599e22d59e594e5aae1dc10560568d8f4a8b upstream. + +The s390_mmio_read/write syscalls are currently broken when running with +MIO. + +The new pcistb_mio/pcstg_mio/pcilg_mio instructions are executed +similiarly to normal load/store instructions and do address translation +in the current address space. That means inside the kernel they are +aware of mappings into kernel address space while outside the kernel +they use user space mappings (usually created through mmap'ing a PCI +device file). + +Now when existing user space applications use the s390_pci_mmio_write +and s390_pci_mmio_read syscalls, they pass I/O addresses that are mapped +into user space so as to be usable with the new instructions without +needing a syscall. Accessing these addresses with the old instructions +as done currently leads to a kernel panic. + +Also, for such a user space mapping there may not exist an equivalent +kernel space mapping which means we can't just use the new instructions +in kernel space. + +Instead of replicating user mappings in the kernel which then might +collide with other mappings, we can conceptually execute the new +instructions as if executed by the user space application using the +secondary address space. This even allows us to directly store to the +user pointer without the need for copy_to/from_user(). + +Cc: stable@vger.kernel.org +Fixes: 71ba41c9b1d9 ("s390/pci: provide support for MIO instructions") +Signed-off-by: Niklas Schnelle +Reviewed-by: Sven Schnelle +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/asm/pci_io.h | 10 + + arch/s390/pci/pci_mmio.c | 213 ++++++++++++++++++++++++++++++++++++++++- + 2 files changed, 219 insertions(+), 4 deletions(-) + +--- a/arch/s390/include/asm/pci_io.h ++++ b/arch/s390/include/asm/pci_io.h +@@ -8,6 +8,10 @@ + #include + #include + ++/* I/O size constraints */ ++#define ZPCI_MAX_READ_SIZE 8 ++#define ZPCI_MAX_WRITE_SIZE 128 ++ + /* I/O Map */ + #define ZPCI_IOMAP_SHIFT 48 + #define ZPCI_IOMAP_ADDR_BASE 0x8000000000000000UL +@@ -140,7 +144,8 @@ static inline int zpci_memcpy_fromio(voi + + while (n > 0) { + size = zpci_get_max_write_size((u64 __force) src, +- (u64) dst, n, 8); ++ (u64) dst, n, ++ ZPCI_MAX_READ_SIZE); + rc = zpci_read_single(dst, src, size); + if (rc) + break; +@@ -161,7 +166,8 @@ static inline int zpci_memcpy_toio(volat + + while (n > 0) { + size = zpci_get_max_write_size((u64 __force) dst, +- (u64) src, n, 128); ++ (u64) src, n, ++ ZPCI_MAX_WRITE_SIZE); + if (size > 8) /* main path */ + rc = zpci_write_block(dst, src, size); + else +--- a/arch/s390/pci/pci_mmio.c ++++ b/arch/s390/pci/pci_mmio.c +@@ -11,6 +11,113 @@ + #include + #include + #include ++#include ++#include ++ ++static inline void zpci_err_mmio(u8 cc, u8 status, u64 offset) ++{ ++ struct { ++ u64 offset; ++ u8 cc; ++ u8 status; ++ } data = {offset, cc, status}; ++ ++ zpci_err_hex(&data, sizeof(data)); ++} ++ ++static inline int __pcistb_mio_inuser( ++ void __iomem *ioaddr, const void __user *src, ++ u64 len, u8 *status) ++{ ++ int cc = -ENXIO; ++ ++ asm volatile ( ++ " sacf 256\n" ++ "0: .insn rsy,0xeb00000000d4,%[len],%[ioaddr],%[src]\n" ++ "1: ipm %[cc]\n" ++ " srl %[cc],28\n" ++ "2: sacf 768\n" ++ EX_TABLE(0b, 2b) EX_TABLE(1b, 2b) ++ : [cc] "+d" (cc), [len] "+d" (len) ++ : [ioaddr] "a" (ioaddr), [src] "Q" (*((u8 __force *)src)) ++ : "cc", "memory"); ++ *status = len >> 24 & 0xff; ++ return cc; ++} ++ ++static inline int __pcistg_mio_inuser( ++ void __iomem *ioaddr, const void __user *src, ++ u64 ulen, u8 *status) ++{ ++ register u64 addr asm("2") = (u64 __force) ioaddr; ++ register u64 len asm("3") = ulen; ++ int cc = -ENXIO; ++ u64 val = 0; ++ u64 cnt = ulen; ++ u8 tmp; ++ ++ /* ++ * copy 0 < @len <= 8 bytes from @src into the right most bytes of ++ * a register, then store it to PCI at @ioaddr while in secondary ++ * address space. pcistg then uses the user mappings. ++ */ ++ asm volatile ( ++ " sacf 256\n" ++ "0: llgc %[tmp],0(%[src])\n" ++ " sllg %[val],%[val],8\n" ++ " aghi %[src],1\n" ++ " ogr %[val],%[tmp]\n" ++ " brctg %[cnt],0b\n" ++ "1: .insn rre,0xb9d40000,%[val],%[ioaddr]\n" ++ "2: ipm %[cc]\n" ++ " srl %[cc],28\n" ++ "3: sacf 768\n" ++ EX_TABLE(0b, 3b) EX_TABLE(1b, 3b) EX_TABLE(2b, 3b) ++ : ++ [src] "+a" (src), [cnt] "+d" (cnt), ++ [val] "+d" (val), [tmp] "=d" (tmp), ++ [len] "+d" (len), [cc] "+d" (cc), ++ [ioaddr] "+a" (addr) ++ :: "cc", "memory"); ++ *status = len >> 24 & 0xff; ++ ++ /* did we read everything from user memory? */ ++ if (!cc && cnt != 0) ++ cc = -EFAULT; ++ ++ return cc; ++} ++ ++static inline int __memcpy_toio_inuser(void __iomem *dst, ++ const void __user *src, size_t n) ++{ ++ int size, rc = 0; ++ u8 status = 0; ++ mm_segment_t old_fs; ++ ++ if (!src) ++ return -EINVAL; ++ ++ old_fs = enable_sacf_uaccess(); ++ while (n > 0) { ++ size = zpci_get_max_write_size((u64 __force) dst, ++ (u64 __force) src, n, ++ ZPCI_MAX_WRITE_SIZE); ++ if (size > 8) /* main path */ ++ rc = __pcistb_mio_inuser(dst, src, size, &status); ++ else ++ rc = __pcistg_mio_inuser(dst, src, size, &status); ++ if (rc) ++ break; ++ src += size; ++ dst += size; ++ n -= size; ++ } ++ disable_sacf_uaccess(old_fs); ++ if (rc) ++ zpci_err_mmio(rc, status, (__force u64) dst); ++ return rc; ++} + + static long get_pfn(unsigned long user_addr, unsigned long access, + unsigned long *pfn) +@@ -46,6 +153,20 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, uns + + if (length <= 0 || PAGE_SIZE - (mmio_addr & ~PAGE_MASK) < length) + return -EINVAL; ++ ++ /* ++ * Only support read access to MIO capable devices on a MIO enabled ++ * system. Otherwise we would have to check for every address if it is ++ * a special ZPCI_ADDR and we would have to do a get_pfn() which we ++ * don't need for MIO capable devices. ++ */ ++ if (static_branch_likely(&have_mio)) { ++ ret = __memcpy_toio_inuser((void __iomem *) mmio_addr, ++ user_buffer, ++ length); ++ return ret; ++ } ++ + if (length > 64) { + buf = kmalloc(length, GFP_KERNEL); + if (!buf) +@@ -56,7 +177,8 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, uns + ret = get_pfn(mmio_addr, VM_WRITE, &pfn); + if (ret) + goto out; +- io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK)); ++ io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | ++ (mmio_addr & ~PAGE_MASK)); + + ret = -EFAULT; + if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) +@@ -72,6 +194,78 @@ out: + return ret; + } + ++static inline int __pcilg_mio_inuser( ++ void __user *dst, const void __iomem *ioaddr, ++ u64 ulen, u8 *status) ++{ ++ register u64 addr asm("2") = (u64 __force) ioaddr; ++ register u64 len asm("3") = ulen; ++ u64 cnt = ulen; ++ int shift = ulen * 8; ++ int cc = -ENXIO; ++ u64 val, tmp; ++ ++ /* ++ * read 0 < @len <= 8 bytes from the PCI memory mapped at @ioaddr (in ++ * user space) into a register using pcilg then store these bytes at ++ * user address @dst ++ */ ++ asm volatile ( ++ " sacf 256\n" ++ "0: .insn rre,0xb9d60000,%[val],%[ioaddr]\n" ++ "1: ipm %[cc]\n" ++ " srl %[cc],28\n" ++ " ltr %[cc],%[cc]\n" ++ " jne 4f\n" ++ "2: ahi %[shift],-8\n" ++ " srlg %[tmp],%[val],0(%[shift])\n" ++ "3: stc %[tmp],0(%[dst])\n" ++ " aghi %[dst],1\n" ++ " brctg %[cnt],2b\n" ++ "4: sacf 768\n" ++ EX_TABLE(0b, 4b) EX_TABLE(1b, 4b) EX_TABLE(3b, 4b) ++ : ++ [cc] "+d" (cc), [val] "=d" (val), [len] "+d" (len), ++ [dst] "+a" (dst), [cnt] "+d" (cnt), [tmp] "=d" (tmp), ++ [shift] "+d" (shift) ++ : ++ [ioaddr] "a" (addr) ++ : "cc", "memory"); ++ ++ /* did we write everything to the user space buffer? */ ++ if (!cc && cnt != 0) ++ cc = -EFAULT; ++ ++ *status = len >> 24 & 0xff; ++ return cc; ++} ++ ++static inline int __memcpy_fromio_inuser(void __user *dst, ++ const void __iomem *src, ++ unsigned long n) ++{ ++ int size, rc = 0; ++ u8 status; ++ mm_segment_t old_fs; ++ ++ old_fs = enable_sacf_uaccess(); ++ while (n > 0) { ++ size = zpci_get_max_write_size((u64 __force) src, ++ (u64 __force) dst, n, ++ ZPCI_MAX_READ_SIZE); ++ rc = __pcilg_mio_inuser(dst, src, size, &status); ++ if (rc) ++ break; ++ src += size; ++ dst += size; ++ n -= size; ++ } ++ disable_sacf_uaccess(old_fs); ++ if (rc) ++ zpci_err_mmio(rc, status, (__force u64) dst); ++ return rc; ++} ++ + SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr, + void __user *, user_buffer, size_t, length) + { +@@ -86,12 +280,27 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsi + + if (length <= 0 || PAGE_SIZE - (mmio_addr & ~PAGE_MASK) < length) + return -EINVAL; ++ ++ /* ++ * Only support write access to MIO capable devices on a MIO enabled ++ * system. Otherwise we would have to check for every address if it is ++ * a special ZPCI_ADDR and we would have to do a get_pfn() which we ++ * don't need for MIO capable devices. ++ */ ++ if (static_branch_likely(&have_mio)) { ++ ret = __memcpy_fromio_inuser( ++ user_buffer, (const void __iomem *)mmio_addr, ++ length); ++ return ret; ++ } ++ + if (length > 64) { + buf = kmalloc(length, GFP_KERNEL); + if (!buf) + return -ENOMEM; +- } else ++ } else { + buf = local_buf; ++ } + + ret = get_pfn(mmio_addr, VM_READ, &pfn); + if (ret) diff --git a/queue-5.4/series b/queue-5.4/series index fc5b0f4c0a5..12fc15e1f65 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -80,3 +80,19 @@ bpf-avoid-setting-bpf-insns-pages-read-only-when-pro.patch kbuild-remove-debug-info-from-kallsyms-linking.patch revert-gfs2-don-t-demote-a-glock-until-its-revokes-a.patch media-fdp1-fix-r-car-m3-n-naming-in-debug-message.patch +staging-iio-ad2s1210-fix-spi-reading.patch +staging-kpc2000-fix-error-return-code-in-kp2000_pcie_probe.patch +staging-greybus-fix-uninitialized-scalar-variable.patch +iio-sca3000-remove-an-erroneous-get_device.patch +iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch +iio-adc-ti-ads8344-fix-channel-selection.patch +misc-rtsx-add-short-delay-after-exit-from-aspm.patch +tty-serial-add-missing-spin_lock_init-for-sifive-serial-console.patch +mei-release-me_cl-object-reference.patch +ipack-tpci200-fix-error-return-code-in-tpci200_register.patch +s390-pci-fix-s390_mmio_read-write-with-mio.patch +s390-kaslr-add-support-for-r_390_jmp_slot-relocation-type.patch +device-dax-don-t-leak-kernel-memory-to-user-space-after-unloading-kmem.patch +rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch +kasan-disable-branch-tracing-for-core-runtime.patch +sh-include-linux-time_types.h-for-sockios.patch diff --git a/queue-5.4/sh-include-linux-time_types.h-for-sockios.patch b/queue-5.4/sh-include-linux-time_types.h-for-sockios.patch new file mode 100644 index 00000000000..9d9a08c25c8 --- /dev/null +++ b/queue-5.4/sh-include-linux-time_types.h-for-sockios.patch @@ -0,0 +1,46 @@ +From fc94cf2092c7c1267fa2deb8388d624f50eba808 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 22 May 2020 22:23:02 -0700 +Subject: sh: include linux/time_types.h for sockios + +From: Arnd Bergmann + +commit fc94cf2092c7c1267fa2deb8388d624f50eba808 upstream. + +Using the socket ioctls on arch/sh (and only there) causes build time +problems when __kernel_old_timeval/__kernel_old_timespec are not already +visible to the compiler. + +Add an explict include line for the header that defines these +structures. + +Fixes: 8c709f9a0693 ("y2038: sh: remove timeval/timespec usage from headers") +Fixes: 0768e17073dc ("net: socket: implement 64-bit timestamps") +Reported-by: John Paul Adrian Glaubitz +Signed-off-by: Arnd Bergmann +Signed-off-by: Andrew Morton +Tested-by: John Paul Adrian Glaubitz +Cc: Yoshinori Sato +Cc: Rich Felker +Cc: "David S. Miller" +Cc: John Paul Adrian Glaubitz +Cc: +Link: http://lkml.kernel.org/r/20200519131327.1836482-1-arnd@arndb.de +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/include/uapi/asm/sockios.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/sh/include/uapi/asm/sockios.h ++++ b/arch/sh/include/uapi/asm/sockios.h +@@ -2,6 +2,8 @@ + #ifndef __ASM_SH_SOCKIOS_H + #define __ASM_SH_SOCKIOS_H + ++#include ++ + /* Socket-level I/O control calls. */ + #define FIOGETOWN _IOR('f', 123, int) + #define FIOSETOWN _IOW('f', 124, int) diff --git a/queue-5.4/staging-greybus-fix-uninitialized-scalar-variable.patch b/queue-5.4/staging-greybus-fix-uninitialized-scalar-variable.patch new file mode 100644 index 00000000000..9ffe1c52b2d --- /dev/null +++ b/queue-5.4/staging-greybus-fix-uninitialized-scalar-variable.patch @@ -0,0 +1,42 @@ +From 34625c1931f8204c234c532b446b9f53c69f4b68 Mon Sep 17 00:00:00 2001 +From: Oscar Carter +Date: Sun, 10 May 2020 12:14:26 +0200 +Subject: staging: greybus: Fix uninitialized scalar variable + +From: Oscar Carter + +commit 34625c1931f8204c234c532b446b9f53c69f4b68 upstream. + +In the "gb_tty_set_termios" function the "newline" variable is declared +but not initialized. So the "flow_control" member is not initialized and +the OR / AND operations with itself results in an undefined value in +this member. + +The purpose of the code is to set the flow control type, so remove the +OR / AND self operator and set the value directly. + +Addresses-Coverity-ID: 1374016 ("Uninitialized scalar variable") +Fixes: e55c25206d5c9 ("greybus: uart: Handle CRTSCTS flag in termios") +Signed-off-by: Oscar Carter +Cc: stable +Link: https://lore.kernel.org/r/20200510101426.23631-1-oscar.carter@gmx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/greybus/uart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -537,9 +537,9 @@ static void gb_tty_set_termios(struct tt + } + + if (C_CRTSCTS(tty) && C_BAUD(tty) != B0) +- newline.flow_control |= GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = GB_SERIAL_AUTO_RTSCTS_EN; + else +- newline.flow_control &= ~GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = 0; + + if (memcmp(&gb_tty->line_coding, &newline, sizeof(newline))) { + memcpy(&gb_tty->line_coding, &newline, sizeof(newline)); diff --git a/queue-5.4/staging-iio-ad2s1210-fix-spi-reading.patch b/queue-5.4/staging-iio-ad2s1210-fix-spi-reading.patch new file mode 100644 index 00000000000..9cd6b4b2030 --- /dev/null +++ b/queue-5.4/staging-iio-ad2s1210-fix-spi-reading.patch @@ -0,0 +1,63 @@ +From 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 Mon Sep 17 00:00:00 2001 +From: Dragos Bogdan +Date: Wed, 29 Apr 2020 10:21:29 +0300 +Subject: staging: iio: ad2s1210: Fix SPI reading + +From: Dragos Bogdan + +commit 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 upstream. + +If the serial interface is used, the 8-bit address should be latched using +the rising edge of the WR/FSYNC signal. + +This basically means that a CS change is required between the first byte +sent, and the second one. +This change splits the single-transfer transfer of 2 bytes into 2 transfers +with a single byte, and CS change in-between. + +Note fixes tag is not accurate, but reflects a point beyond which there +are too many refactors to make backporting straight forward. + +Fixes: b19e9ad5e2cb ("staging:iio:resolver:ad2s1210 general driver cleanup.") +Signed-off-by: Dragos Bogdan +Signed-off-by: Alexandru Ardelean +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/resolver/ad2s1210.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/staging/iio/resolver/ad2s1210.c ++++ b/drivers/staging/iio/resolver/ad2s1210.c +@@ -130,17 +130,24 @@ static int ad2s1210_config_write(struct + static int ad2s1210_config_read(struct ad2s1210_state *st, + unsigned char address) + { +- struct spi_transfer xfer = { +- .len = 2, +- .rx_buf = st->rx, +- .tx_buf = st->tx, ++ struct spi_transfer xfers[] = { ++ { ++ .len = 1, ++ .rx_buf = &st->rx[0], ++ .tx_buf = &st->tx[0], ++ .cs_change = 1, ++ }, { ++ .len = 1, ++ .rx_buf = &st->rx[1], ++ .tx_buf = &st->tx[1], ++ }, + }; + int ret = 0; + + ad2s1210_set_mode(MOD_CONFIG, st); + st->tx[0] = address | AD2S1210_MSB_IS_HIGH; + st->tx[1] = AD2S1210_REG_FAULT; +- ret = spi_sync_transfer(st->sdev, &xfer, 1); ++ ret = spi_sync_transfer(st->sdev, xfers, 2); + if (ret < 0) + return ret; + diff --git a/queue-5.4/staging-kpc2000-fix-error-return-code-in-kp2000_pcie_probe.patch b/queue-5.4/staging-kpc2000-fix-error-return-code-in-kp2000_pcie_probe.patch new file mode 100644 index 00000000000..207bb2a89dc --- /dev/null +++ b/queue-5.4/staging-kpc2000-fix-error-return-code-in-kp2000_pcie_probe.patch @@ -0,0 +1,50 @@ +From b17884ccf29e127b16bba6aea1438c851c9f5af1 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Wed, 6 May 2020 13:47:35 +0000 +Subject: staging: kpc2000: fix error return code in kp2000_pcie_probe() + +From: Wei Yongjun + +commit b17884ccf29e127b16bba6aea1438c851c9f5af1 upstream. + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. Also +removed var 'rv' since we can use 'err' instead. + +Fixes: 7dc7967fc39a ("staging: kpc2000: add initial set of Daktronics drivers") +Signed-off-by: Wei Yongjun +Cc: stable +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200506134735.102041-1-weiyongjun1@huawei.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/kpc2000/kpc2000/core.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/staging/kpc2000/kpc2000/core.c ++++ b/drivers/staging/kpc2000/kpc2000/core.c +@@ -298,7 +298,6 @@ static int kp2000_pcie_probe(struct pci_ + { + int err = 0; + struct kp2000_device *pcard; +- int rv; + unsigned long reg_bar_phys_addr; + unsigned long reg_bar_phys_len; + unsigned long dma_bar_phys_addr; +@@ -445,11 +444,11 @@ static int kp2000_pcie_probe(struct pci_ + if (err < 0) + goto err_release_dma; + +- rv = request_irq(pcard->pdev->irq, kp2000_irq_handler, IRQF_SHARED, +- pcard->name, pcard); +- if (rv) { ++ err = request_irq(pcard->pdev->irq, kp2000_irq_handler, IRQF_SHARED, ++ pcard->name, pcard); ++ if (err) { + dev_err(&pcard->pdev->dev, +- "%s: failed to request_irq: %d\n", __func__, rv); ++ "%s: failed to request_irq: %d\n", __func__, err); + goto err_disable_msi; + } + diff --git a/queue-5.4/tty-serial-add-missing-spin_lock_init-for-sifive-serial-console.patch b/queue-5.4/tty-serial-add-missing-spin_lock_init-for-sifive-serial-console.patch new file mode 100644 index 00000000000..e983f1d8c1d --- /dev/null +++ b/queue-5.4/tty-serial-add-missing-spin_lock_init-for-sifive-serial-console.patch @@ -0,0 +1,41 @@ +From 17b4efdf4e4867079012a48ca10d965fe9d68822 Mon Sep 17 00:00:00 2001 +From: Sagar Shrikant Kadam +Date: Sat, 9 May 2020 03:24:12 -0700 +Subject: tty: serial: add missing spin_lock_init for SiFive serial console + +From: Sagar Shrikant Kadam + +commit 17b4efdf4e4867079012a48ca10d965fe9d68822 upstream. + +An uninitialised spin lock for sifive serial console raises a bad +magic spin_lock error as reported and discussed here [1]. +Initialising the spin lock resolves the issue. + +The fix is tested on HiFive Unleashed A00 board with Linux 5.7-rc4 +and OpenSBI v0.7 + +[1] https://lore.kernel.org/linux-riscv/b9fe49483a903f404e7acc15a6efbef756db28ae.camel@wdc.com + +Fixes: 45c054d0815b ("tty: serial: add driver for the SiFive UART") +Reported-by: Atish Patra +Signed-off-by: Sagar Shrikant Kadam +Reviewed-by: Palmer Dabbelt +Acked-by: Palmer Dabbelt +Cc: stable +Link: https://lore.kernel.org/r/1589019852-21505-2-git-send-email-sagar.kadam@sifive.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sifive.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/tty/serial/sifive.c ++++ b/drivers/tty/serial/sifive.c +@@ -840,6 +840,7 @@ console_initcall(sifive_console_init); + + static void __ssp_add_console_port(struct sifive_serial_port *ssp) + { ++ spin_lock_init(&ssp->port.lock); + sifive_serial_console_ports[ssp->port.line] = ssp; + } +